{ ... }:
{
  # Fetch runner token from Vault
  vault.secrets.forgejo-runner-token = {
    secretPath = "hosts/nix-cache02/forgejo-runner-token";
    extractKey = "token";
    mode = "0444";
    services = [ "gitea-runner-actions1" ];
  };

  # Override token source and runner capacity
  services.gitea-actions-runner.instances.actions1 = {
    tokenFile = "/run/secrets/forgejo-runner-token";
    settings.runner.capacity = 4;
  };
}